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We present a hashing protocol for distilling multipartite CSS states by means of local Clifford 
operations, Pauli measurements and classical communication. It is shown that this hashing protocol 
outperforms previous versions by exploiting information theory to a full extent an not only applying 
CNOTs as local Clifford operations. Using the information-theoretical notion of a strongly typical 
set, we calculate the asymptotic yield of the protocol as the solution of a linear programming 
problem. 
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I. INTRODUCTION 



Stabilizer states and codes are an important concept 
in quantum information theory. Stabilizer codes 
play a central role in the theory of quantum error correct- 
ing codes, which protect quantum information against 
decoherence and without which effective quantum com- 
putation has no chance of existing. Recently, a promis- 
ing alternative setup for quantum computation has been 
found that is based on the preparation of a stabilizer state 
(more specifically a cluster state) and one-qubit measure- 
ments |llj . Also in the area of quantum cryptography 
and quantum communication, both bipartite as multi- 
partite, the number of applications of stabilizer states is 
abundant. We cite Refs. [Illlllillllllllliiillll, 
but this is far from an exhaustive list. 

Closely related to quantum error correction, entangle- 
ment distillation is a means of extracting entanglement 
from quantum states that have been disrupted by the 
environment. Many applications require pure multipar- 
tite entangled states that are shared by remote parties. 
In practice, these pure states are prepared by one party 
and communicated to the others by an imperfect quan- 
tum channel. As a result, the states are no longer pure. 
A distillation protocol then consists of local operations 
combined with classical communication in order to end 
up with states that approach purity and are suited for 
the application in mind. An interesting distillation pro- 
tocol for Bell states is the well-known hashing protocol, 
introduced in Ref. 0], that has its roots in classical in- 
formation theory. 

In this paper, we describe a generalization of this hash- 
ing protocol from bipartite to multipartite. It distills an 
important particular kind of stabilizer states, called CSS 
states, short for Calderbank-Shor-Steane states. Bell 
states, cat states and cluster states (more generally two- 
colorable graph states) are examples of or locally equiva- 
lent to CSS states. In brief, the protocol goes as follows: 
k copies of an n-qubit mixed state are shared by n re- 
mote parties. They perform local unitary operations and 
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measurements that, if k is large, result in a state that 
approaches ^k copies of a pure n-qubit CSS state, where 
7 < I is the yield of the protocol. The basic idea of de- 
scribing the protocol in a classical information theoretical 
setting is the same as in Ref. |^. 

Very similar multipartite hashing protocols have been 
discussed in Refs. |1 0, Ref. and Ref. Q for two- 
colorable graph states, cat states and CSS states respec- 
tively. Our protocol improves these protocols in two 
ways. First, we note that in Refs. IE ^ IS; by not 
exploiting information theory to a full extent, their pro- 
tocols result in overkill. In short, demanding that the 
number of measurements exceed the marginal entropies 
S B of each separate party results in too many mea- 
surements. In Ref. 0, this is partially meeted by relaxing 
to conditional entropies. We will show that our protocol 
is optimal in the given setting and is therefore a com- 
plete generalization of the hashing protocol for Bell states 
to CSS states. The yield is calculated as the solution 
of a linear programming problem, and requires a some- 
what more involved information-theoretical treatment. A 
second major difference is that the local unitary opera- 
tions appHed in Refs. [1I1I1I3 only consist of CNOTs, 
whereas in some cases a higher yield can be achieved by 
using more general local Clifford operations. To this end, 
we need to know which local Clifford operations result in 
a permutation of all possible 2"*^ fc-fold tensor products 
of an n-qubit CSS state. This is done efficiently using the 
binary matrix description of stabilizer states and Clifford 
operations of Ref. Q . 

This paper is organized as follows. In section III Al 
we introduce the binary framework in which stabilizer 
states and Clifford operations are efficiently described. 
In section IIIBI we define the strongly typical set, an 
information-theoretical concept that is needed to calcu- 
late the yield. In section IIIII we derive necessary and 
sufficient conditions that local Clifford operations have 
to satisfy to result in a permutation of the 2"^^ fc-fold 
tensor products of an n-qubit CSS state. This result is a 
generalization of Ref. 7] , and is also interesting for more 
recurrence-like protocols as also introduced in Ref. (5, 13| . 
But we will not go deeper into this issue in this paper. In 
section IIVI we explain how our hashing protocol works 
and calculate the yield in section Finally, the proto- 
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col is illustrated and compared to others by an example 
in section rVn Readers that are merely interested in the 
results can skip almost entirely sections IIIBI IIIII Ivl and 
the appendices. 



II. PRELIMINARIES 

A. Stabilizer states, CSS states and Clifford 
operations in the binary picture 

In this section, we present the binary matrix descrip- 
tion of stabilizer states and Clifford operations. We show 
how Clifford operations act on stabilizer states in the bi- 
nary picture. We also formulate a simple criterion for 
separability of a stabilizer state. CSS states are then de- 
fined as a special kind of stabilizer states, and we show 
the particular properties of their binary matrix descrip- 
tion. We will restrict ourselves to definitions and prop- 
erties that are necessary to the distillation protocols pre- 
sented in the next sections. In the following, all addi- 
tion and multiplication is performed modulo 2. For a 
more elaborate discussion on the binary matrix descrip- 
tion of stabilizer states and Clifford operations, we refer 
to Ref. 1]. 

We use the following notation for Pauli matrices. 



will assemble the vectors Si as the columns of a matrix 
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Let V, w G Z2 and a 



, then we denote 



S eZi 



and the bits bi in a vector 6 G Z,. Note that 



it follows from ^ that commutativity of the stabilizer 
is reflected by S^PS = 0. The representation of 5 by 5 
and b is not unique, as every other generating set of S 
yields an equivalent description. In the binary picture, a 
change from one generating set to another is represented 
by an invertible linear transformation R e Z2 ^" acting 
on the right on S and acting appropriately on b. We have 



S' = SR 
b' = R^b^ 



(2) 



where d e Z2 is a function of S and R but not of 6 Q]. 
We will show below that in the context of distillation 
protocols, d can always be made zero. 

Each S defines a total of 2" orthogonal stabilizer states, 
one for each 6 e Zj. As a consequence, all stabilizer 
states defined by S constitute a basis for 7i®", where H 
is the Hilbert space of one qubit. In the following, we 
will refer to this basis as the ^-basis. 

A Clifford operation Q, by definition, maps the Pauli 
group to itself under conjugation: 



Q<JaQ^ = (- 



It is clear that the Pauli group is a subgroup of the Clif- 
ford group, as 



CTvaaul = (-1) 



v' Pa 



In the binary picture, a Clifford operation is represented 
by a matrix C € ^2"^^" and a vector h e Z2", where C is 
symplectic or C^PC = P [H. The image of a Hermitian 
Pauli operator a a under the action of a Clifford operation 
is then given by (— 1)'(Tco, where e is function of C, h and 
a. Note that the phase factor of the image can always 
be altered by taking Q' = Qug instead of Q, where <jg 
anticommutes with aa^ or a^Pg = 1, as 



The Pauli group on n qubits is defined to contain all 
tensor products ctq of Pauli matrices with an additional 
complex phase factor in 1,— i}. In this paper we 

will only consider Hermitian Pauli operators, so we may 
exclude imaginary phase factors. Note that all Hermitian 
Pauli operators square to the identity. It can also be 
easily verified that Pauli operators satisfy the following 
commutation relation: 



If a stabilizer state represented by S and 6, is oper- 
ated on by a Clifford operation Q, represented by C and 
h, Q\'ip) is a new stabilizer state whose stabilizer is given 
by QSQ'^ . As a result, this stabilizer is represented by 



S" = CS 
b' = b + f 



(3) 



1)" cTbCTa, where P 



/„ 

In 



(1) 



A stabilizer state {ip) on n qubits is the simultaneous 
eigenvector, with eigenvalues 1, of n commuting Hermi- 
tian Pauli operators (— 1)^'CTs;, where Si S Z|" are lin- 
early independent and bi G Z2, for i = 1, . . . ,n. The n 
Hermitian Pauli operators generate an Abelian subgroup 
of the Pauli group on n qubits, called the stabilizer S. We 



where / is independent of b and can always be made 
zero, by performing an extra Pauli operator Ug before the 
Clifford operation, where S^Pg = f. Because S is full 
rank, this equation always has a solution. The resulting 
Clifford operation is then Q' = Qag instead of Q. With 
this, C remains the same, but 6' = 6 in In the same 
way, d in can be made zero. Thus, from now on, 
we may neglect the influence of h on the protocol and 
represent a Clifford operation only by C. 
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Let \ipi) and \tp2) be two stabilizer states represented 



by 



, bi and 5*2 

Then (g) \ip2) is a stabilizer state represented by 



s. 



2{z) 
2(x) 



, 62 respectively. 



liz) 


■ 





S2{z) 


l{x) 








S2{x) - 



bi 
b2 



(4) 



Conversely, a stabilizer state \Tp) represented by S, b is 
separable iff there exists a permutation matrix T G Z2 ^" 
and an invertible matrix Re Z^^" such that {I2'^T)SR 
has a block structure as in 10}. Note that left multi- 
plication with {I2 (8) T) on 5 is equivalent to permuting 
the qubits and right multiplication with R on S yields 
another representation of |?/;). 

Let Qi and Q2 be two Clifford operations represented 
' A2 B2' 
C2 D2 
Then Qi 



by 



and 



blocks are in Z^""". 
ation represented by 



respectively, where all 
§ (52 is a Clifford oper- 



Ai Bi 

A2 B2 

Ci £»! 

C2 D2 



(5) 



which has the block structure defined in Q. 

If the phase factors (—1)''', for i = 1, . . . , n, of a CSS 
state represented by (O are unknown, a measurement 
on every qubit reveals hi, for « = 1, . . . ,71^. Indeed, the 
measurements project the state on the joint eigenspace of 



observables a 



(i) 



-in 



for j = 1, 



with eigenvalues (— 1)"^ that are determined by the mea- 
surements. We then have 



b = 



The last Ux phase factors * are lost due to the fact that 
all a Si , for i = -|- 1, . . . , n, anticommute with at least 

(7) 

one (Ti . On the other hand, by cjx measurements on 
every qubit, with outcomes (—1)"^, we learn that 



6 = 



S'la 



More generally, we can divide {1, . . . , n} into two disjunct 
subsets Mz and Mx- A CTz measurement on every qubit 
i € Mz and a ax measurement on every qubit i € Mx re- 
veals all r^b, r G Z2 , for which Sr has zeros on positions 
i for i G Mx and on positions n + i for i G AIz ■ 



B. Strongly typical set 



A CSS state, or Calderbank-Shor-Steane state, is a 
stabilizer state whose stabilizer can be represented 
by 



S 



Sz 




where Sz G 



Sx G Z" 



, b 



and 



(6) 



= n. The 



stabilizer condition S^PS = is equivalent to SjSx — 0. 
As S is full rank, Sz and Sx are also full rank. There- 
fore, once Sz (or Sx) is known, we know S, up to right 
multiplication with some R. The following statements 
involving ^2 also hold when using Sx- The state is 
separable iff there exists a permutation matrix T G Zj ^" 
and an invertible matrix R G Z^^^"^ such that 



TS,R = 



S'z 
S'J 



where S'z G S'J G Z2 

n'! = Uz and < n' < n. 



are full rank, it is possible to find S'x G Z2 "'^ 



, n + ?T. = n., + 
Indeed, since Si and 5" 

and 



5",^ G Zo 



' X (n"— n") 



such that S'/S'^O and S*"' S*" = 0. 



The stabilizer that results from the qubit permutation T 
is represented by 



S*^ 

s*;' 

5^ 

S*" 



In this section, we introduce the information- 
theoretical notion of a strongly typical set. We will need 
this in section^ This section is self-contained, but for an 
introduction to information theory, we refer to Ref. Q. 

Let X = {Xi, . . . ,Xk) be a sequence of independent 
and identically distributed discrete random variables, 
each having event set O with probability function p : f2 1— > 
[0, 1] : a 1-^ pia). The strongly typical set T^'^^ is defined 
to be the set of sequences x = {xi , . . . ,Xk) G rJ*"' for which 
the sample frequencies faix) = \{xi \ Xi = a\\/k are close 

to the true values p(a), or: x G 7^'*^' 



\fa{x)-p{a)\ < e, Va G Vt. 



(7) 



It can be verified that faiX) has mean p{a) and variance 
p(a)[l — p{a)]/k. By Chebyshev's inequality 0, we have 



P{\fa{X)-p{a)\>e)< 



fce2 



It follows that p(r,^''^) > 1 - (5, where 6 = 0{k-^e-^). 

In section we will encounter the following problem. 
Let fl be partitioned into subsets fij (j = 1, . . . , g). We 
define the function 

y{x) — (riji, . . . ,^^jfc), where Xi G ilj^, for i — 1, . . . , k. 

Given some u G t}''\ calculate the number \J^u\ of se- 
quences V G T^^'^' that satisfy y(u) = y{u), or 

AA„ = G r,^'^) I y{v) = yiu)}. 
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For all V £ Afu and for j = 1, . . . , g, it holds 



Fix fa satisfying and © and call A// the set of ele- 
ments V € Afu with these sample frequencies fa- Then 
elementary combinatorics tells us 



7in.,o,[/a(«)fc]!' 

Using Stirling's approximation for large k: 

Infc! = fclnfc-fc + 0(lnfc), 
and we find that log2 \Aff\ — 0(log2 k)+ 



fn, (v) log2 /fj^ {v) - E /a(^) log2 /a(«) 



As G 7^ , we have that fa{v) = p{a) + 0(e), for all 
a & n. Therefore, 

log2 Wf\ = k[H{X) - HiY) + 0{e)] + 0{log, k) 

where H{X) = — X^aJ'l") log2P('^) is the entropy of X 
and = — log2P(^j) the entropy of y{X). 

It is clear that |A//| < |A/^ti|. Since there is a total < (2e/c)' 
of / that satisfy 0, an upper bound for \Nu\ is 

(2efc)«max|AA/|, 

where the maximum is taken over all / that satisfy ((TJ- 
©. It follows that 



III. LOCAL PERMUTATIONS OF PRODUCTS 
OF CSS STATES 

In this section, we consider n-qubit CSS states that are 
all represented by the same S. We have k states that are 
shared by n remote parties, each holding corresponding 
qubits of all k states. We study local Clifford operations 
(local with respect to the partition into n parties) that 
result in a permutation of all 2"*^ possible tensor products 
of such CSS states. As the distillation protocol described 
in the next section only consists of local operations, we 
may assume that 5 defines fully entangled states. Indeed, 
if S would define separable states, the protocol would be 
two simultaneous protocols that do not influence each 
other. 

If iV'i) (z = 1, . . . , A:) are represented by 









according to l@J, iV'i 



h®S,^ 

h^^Sa; 



IV'fc) is represented by 

y 



However, since it is more convenient to arrange all qubits 
per party, we rewrite the stabilizer matrix by permuting 
rows and columns as 



S^®Ik 
S^®Ik 



(9) 



where the entries of b' are permuted appropriately into 
h Zf". All parties perform local Clifford operations. 
According to lO, the overall Clifford operation is then 
most generally represented by 



A B 

c b 



"^1 




Bi 






A-n 




Bn 






Di 













(10) 



where the representations of the local Clifford operations 



A, B, 
C, D, 



2fcx2fc 



are symplectic matrices, or 



Ci + Cj^ Ai 
BfD, + DfB, 
AJD, + CTB, 






h 



for i — \, 



(11) 



The local Clifford operations acting on the given state 
result in a permutation of all 2"*^ possible tensor prod- 
ucts (defined by h) iff the resulting stabilizer matrix can 
be transformed into the original form of jnj by multipli- 
cation with an invcrtiblc R G Zj'^^"'^ on the right, or 



A B 
C b 



{S(g)Ik)R = S(g)Ik. 



(12) 



Using Q and , the corresponding permutation of the 
tensor products is then defined by the transformation 



(13) 



We now investigate for which local Clifford operations 
an R can be found such that H12|) holds. Without loss of 
generality, we may assume that 



(14) 



" In. ' 






e 




_In^ _ 



5 



where € 112"^"" ■ This can be obtained by multiphca- 
tion with an invertible R on the right. Let 



A, 



A, 



A 



Ar. 



Using analogous definitions for Bz, Bx,Cz,Cx, and 
Dx, the left hand side of (|12(l becomes 



Az Bz 
Ax Bx 
Cz Dz 
Cx Dx 

Az 



■Ik 



riz 

0(g>lk 



Bzie^^i, 








R 



Ax{e®h) Bx 

Cz bz{e^®ik) 
Cx{e®ik) Dx 



R. 



We can now write 1)121) as two separate equations: 

Az Bz{e^®ik) 

Cx{B®h) Dx 

Cz Dz{d^<E>Ik) 
Axi0(S>Ik) Bx 

Eliminating R, we get 



R 



R = 



e^(^ h 
34 



(15) 



0^(g>ik 
e®h 



Az Bzie'^^h) 
Cx[e®h) Dx 

Cz Dz{9'^<E>Ik) 

Ax{e®ik) Bx 



which is a necessary and sufficient condition on the local 
Clifford operations (|10|l such that an R exists that satis- 
fies (I12|) . Blockwise comparison of both sides yields the 
following equations 

{e®h)Az = Ax{e®h) (16) 
{9'^ ®h)bx - bzie'^^h) (17) 
ie^ik)Bz{e^ ®ik) = Bx (18) 

(9^ ® Ik)Cx{0 ® Ik) = Cz (19) 

From H16|l - H17() and the fact that 9 represents fully en- 
tangled CSS states, it follows that (see Appendix 



Ai = 
Di - 



— Afi — A 

- Dr. = D. 



(20) 



Furthermore, if 9 is orthogonal, or 9'^9 — In/2 where n 
is even, it follows from (|18|l - p9|l that the same holds for 
Bj and C,. Thus, we have 



A 


B 




C 


D 





'C In 



)B 
>D 



If 9 is orthogonal, then SjSz = and it is better to 
represent the stabilizer by choosing Sx = Sz instead of 
With this, the left hand side of ((T^ becomes 



C In 



)B 
>D 



Sz^h 
Sz(E>Ik 



R 



which, with Hll|l . is equal to S (E) Ik iff 



R = 



ln/2 ' 



D' 



ln/2 ' 



Ir. 



/2' 



12 



B^ 

~A^ 



(21) 



However, mostly 9 is not orthogonal. In that case, 
(dl-lCnil can only hold (see Appendix if = for 
all i E Zb and Ci = for all i G Zc, for some Zb, Zc C 
{1, . . . , n} and Zb U Zq = {1, . . . , n}. So we always have 
either Bi or Ci equal to zero, for every i = l,...,n. 
From (ini) it then follows that D = {A'^)~^ = A-^ and 
that A^Ci and A~^Bi are symmetric, for alH = 1, . . . , n. 
Note that local Clifford operations (|10|l that satisfy these 
properties together with (|20|l form a subgroup of the Clif- 
ford group. Only for these local Clifford operations, Hlt)|) - 
(|T^ hold. With ((T5|l , it can now be verified that 



In^(g>A-^ B^{9^(g>h) 

C^i9®h) In.<S)A^ 



(22) 



Finally, we mention that (|18|I - H19|) are equivalent to the 
following linear constraints (see Appendix 



Lir 



9^ 

Lj 



Bi 

Bn 

Ci 

Cn 



0. 



(23) 



(24) 



The n^-bit columns of Lgr are {9'^)j (6*^);, Vj, Z : 1 < 
j < I < Tlx, which stands for the elementwise product of 
columns j and I of 0"^. An analogous definition holds for 
Lq. This will be of interest in section Ivl 

Finally, we summarize this section. For a particular 
CSS state, we want a general formula for R such that 
(|12|1 holds. First, we rewrite S in the form of (|14() . Then 
we distinguish two cases. If 9 is orthogonal, then R is 
given by (|21|l . If 9 is not orthogonal, then R is given by 
(|22|l where the constraints H23|l - H24|) must be satisfied. 
Note that the symplecticity condition l|ll() remains to be 
satisfied at all times. 



IV. PROTOCOL 

In this section, we show how the hashing protocol for 
CSS states is carried out. As noted in section III Al all 



2" stabilizer states represented by the same S G Zj"^" 
constitute a basis for 7i®", which we call the S'-basis. 
The protocol starts with k identical copies of a mixed 
state p that is diagonal in this basis. This mixed state 
could for instance be the result of distributing k copies 
of a pure CSS state, represented by S and 6 = 0, via 
imperfect quantum channels. If p is not diagonal in the 
S'-basis, it can always be made that way by performing 
a local POVM. We refer to Ref. ;2j for a proof. We have 



parties 

> 



where |V'b) is the CSS state represented by S and b. The 
mixed state p can be regarded as a statistical ensemble 
of pure states \ipb) with probabilities p{b). Consequently, 
k copies of p are an ensemble of pure states represented 
by jnj) with probabilities 



p{b)=pib') = llp{h). 



(25) 



Recall that the entries of b correspond to the nk phase 
factors ordered per party instead of per copy like 6'. 

The protocol now consists of the following steps (this 
is schematically depicted in figure^: 

1. Each party applies local Clifford operations H1U|) 
that result in the transformation (|13() of b. Conse- 
quently, all 2"*^ tensor products represented by the 
2nk (\[gQYent b in the ensemble are permuted. 

2. A fraction mk of all k copies are measured locally. 
These copies are divided in two sets with ruzk and 
rrixk copies respectively (m^ -I- rrix = m). Each of 
the n parties performs a tiz measurement on every 
qubit they have of the first set of copies, and a 
measurement on every qubit of the second set. 

The local Clifford operations result in a permutation b i— > 
R^b of all tensor products such that the ensembles of the 
different copies become statistically dependent. We will 
specify R later. The measurements provide information 
on the overall state. The goal of the protocol is to collect 
enough information for the (1 — m)k remaining copies 
to approach a pure state. The yield j — 1 — m of the 
protocol is the fraction of pure states that are distilled 
out of k copies, if k goes to infinity. 

It is important to mention that, next to exclusive cr^ 
or measurements, the qubits of a copy to be measured 
could be partitioned into two disjunct sets and 
and measured appropriately. This too will provide infor- 
mation on the state, as explained in section lll Al Then all 
copies to be measured should be divided into a number 
of sets: one set for each possible partition (2" in total). 
Evidently, not all partitions will be interesting and some 
of them can be ruled out from the beginning. Otherwise, 
it will follow from the calculations that no copy should be 
measured according to those partitions. For simplicity, 
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FIG. 1: in the first step, local Clifford operations (local with 
respect to the parties) result in statistically dependent copies. 
In the second step, some of the copies are measured, providing 
information on the global state. Afterwards, the measured 
copies are separable. 



we will restrict ourselves to the partitions = (only 
az measurements) or Mz = (only ax measurements). 
All derivations still hold in the general case. 

Thus far, we have not specified R. The measurement 
outcomes should contain as much information as possible. 
Therefore, the outcome probabilities should be uniform. 
This is achieved as follows. Recall that if 6 is orthogonal, 
all possible R are of the form (|21|l with constraints 
If 9 is not orthogonal, all possible R are of the form H22() 
with constraints Hll|l and H23|l - 124|) . Wc now randomly 
pick an clement of the set of all possible R. We will 
prove in the next section that this yields uniform outcome 
probabilities. 

A way of looking at the ensemble is to regard it as an 
unknown pure state. The probability that the state is 
represented by b is then equal to p{b). Suppose the un- 
known pure state is represented by u. With probability 
> 1 — (5, where S = 0(fc~^e~^), u is contained in the 



set 7'e '^\ defined as in sectionlll Bl Here, Q is the set of 



all b £ Z,2- We now assume that u g X^""' . After each 



-(fe) 



measurement, we eliminate every b e rr' that IS incon- 
sistent with the measurement outcome. The protocol has 
succeeded if all 6 ^ m are eliminated from T^''^ and only u 
is left. Indeed, by the assumption made, at least u must 
survive this process of elimination. With probability < S, 
this assumption is false: in that case, the protocol will 
end up with a state presumed to be represented by some 
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b G % but is not, which means that the protocol has 
failed. 

In the next section, we will calculate the yield of the 
protocol as the solution of the following linear program- 
ming problem: 7 = 1 — to, where to is the solution to 

minimize to = to^ + mx 
subject to d^m^ + dxTUj; > H - H[d^.d^], 
foraU ^ [0,0], 

< < n^, 

< C?a: l^n^. 

H is the entropy of the initial mixed state, or 
bezj 

The calculation of is more involved. Define the 

subspace — {w & Z2I J"^w = 0} of Zj, where J is 
a matrix with n rows and defined below. The cosets Qj 
{j — 1 , . . . , g) of this subspace constitute a partition of 
Z2 . This partition has entropy 

Hj±- = -^p(^)log2p(%). 

Now ^^[(ij.dj;] is defined as follows: 
min Hj± , 

where the minimum is taken over all subspaces Qz of Z2 ^ 
with dimension — and subspaces Gx of Zj^ with 
dimension Ux — dx- The matrix J that defines J^'^ is 
function of and Gx as follows: 

• if 6* is orthogonal: 

We use the representation where Sx = Sz- We have 

j^IGzO Gx 

[ Gz Gx _ ■ 

• if 6* is not orthogonal: 

Let Me be a matrix whose column space is the or- 
thogonal complement of that of Lg and Algr like- 
wise for LgT (for a definition of Lg,LgT see the 

end of section HTl. Let Gz S Z2' ''^"^"''^^ e 
jn^^{n^ d^) matrices whose column spaces are 
Qz ) Gx respectively. Then we have 

j_ Gz V 

U Gx ' 

The Ux rows of U are the Kronecker products of the 
corresponding rows of 9Gz and Mg. The Uz rows of 
V are the Kronecker products of the corresponding 
rows of O^Gx and Mgr. 




FIG. 2: two equivalent views of the protocol. Subsequent 
random Clifford operations (Ci,C2,C3) performed only on 
non-measured copies, each followed by the measurement of 
a single copy are equivalent to performing just one random 
Clifford operation (C) and the same measurements. 

V. CALCULATING THE YIELD 

This section is organized as follows. In the first sub- 
section we show that the outcome probabilities of each 
measurement are uniform. This is used to calculate the 
probability that some b ^ u is not eliminated after all 
measurements. In the second subsection we then cal- 
culate the minimal number of measurements needed to 
eliminate all b ^ u. This is stated as a linear program- 
ming problem. We will assume that 6 is not orthogonal. 
All derivations for the other case are very similar. 

Before we go into the detailed calculation of the yield, 
we give two different but equivalent views of the protocol. 
As stated in the previous section, the protocol consists 
of a Clifford operation followed by measurements. This 
Clifford operation is randomly picked out of all Clifford 
operations that are local and result in a permutation as 
explained in section ITTll Now suppose we would perform 
such a random Clifford operation after every measure- 
ment, but only on the copies left (i.e. not measured). As 
every measurement commutes with every Clifford oper- 
ation that follows, all measurements can be postponed 
until the end. It is clear that if all Clifford operations 
performed are random and yield a permutation, the same 
holds for the overall Clifford operation. In the following 
subsection, we will use this second view. Both views are 
illustrated in figure [3 

A. Elimination probability 

We will first calculate the probability that some b ^ u 
is not eliminated after a Uz measurement on the i-th copy. 
As explained in section III Al this reveals 

= (-R^")(j-i)fe+t, for j = 1, . . . , nz, 

while 

Xj = (-R'^w)(n,+i-i)fc+i, for i = 1, • • ■ , nx, 

are lost. For a Ux measurement, it is the other way 
around. Iff (i?)^_i)j,_,_,(5 -t- m) = for j = 1,...,^^, 

then b is not eliminated. Assume that the i-th copy is 
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the first measured. For the measurement outcome, we 
are only interested in the i-th columns of and 
{I = Uz + 1, ■ ■ ■ ,n). We define a = {A^^)i and 



From the randomness of R, it follows that a and c are 
uniformly distributed over all possibilities. We denote 
the sets of all possibilities for a and c by TZa and TZc 
respectively. It is clear that TZa = ^2 \ {0}- However, we 
assume that TZa = ^2 ? as there is a negligible probability 
(2"*^) that a is chosen equal to (even during the course 
of the process, this probability will be < 2"''''^ and 7 > 0). 
From (|24|l . we have 



TZc 



{c e Z^'^ I {Lj ® h)c = 0}. 



We define the matrix Vz G Zl 



ifexr 



with columns 



{Vz)j = (i?)(j-i)/c+j, for j = 1, . . . ,n^, and Vz as the set 
containing all possible values of Vz, which is uniformly 
distributed too. Note that Vz is a vector space, because 
TZa and TZc are vector spaces and Vz is a linear function of 
a and c. Let Ab = b + u and Az = V^ Ab. For some fixed 
Ab, all values Az e Z = {V^Ab \ Vz e Vz} are equiprob- 
able. Indeed, all cosets of the kernel of the linear map 
Vz^ Z : Vz ^ Az = V^Ab have the same number of 
elements. Let dz < Uz be the dimension of the range Z 
of this map. Then we have 2'^' possible equiprobable Az 
for some fixed Ab. Only when Az = 0, which happens 
with probability 2~ % b is not eliminated from % by 
the first measurement. The same reasoning can be done 
for a ax measurement. Note that dz = = only holds 
for u itself. 

By performing the local Clifford operation and mea- 
surement on the i-th copy, a vector b e Z^'^ is trans- 
formed into R^b e Z2 '■'^ ^\ where R is equal to R with- 
out columns {j — l)k + i, for j = 1, . . . , n. For the second 
and each following measurement, the reasoning above 
can be repeated for the transformed H^b, except that 
we have k — 1, k — 2, . . . ,k — m = copies instead of k. 
A crucial observation is that for every next measurement, 
the probability that the state initially represented by b is 
not eliminated, almost certainly remains the same during 
the entire process. Therefore, the probability that some 
b for which Z has dimension dz and X has dimension 
dx is not eliminated after all measurements is equal to 
2~k{d^m^+d^m^) ^ -y^^ postpouc the proof to Appendix IbI 



B. Minimal number of measurements 



" (k) 

rule out all inconsistent b G % . The probability that 
some b ^ u survives this process is 2~''^'^'"^''^'''^"^^\ The 
total failure probability pf of the protocol is equal to 
Pi + P2, where pi is the probability that u ^ tJ''^^ in the 
first place and p2 the probability that any b ^ u survives 
the process. We already know that pi < S. Now we cal- 
culate an upper bound for p2 and the minimal fraction m 
of all copies that has to be measured such that pi? — > 
for k ^ 00. 

" (k) 

To this end, we approximate the number of 6 G 7^ for 
which Z has dimension < dz and X has dimension < d^. 
Call this number A^frf^.d^]- We will see that N^d^,d^] — 
2'=["[<i;=,dx]+o(fc ^''')]^ where a[d,,d^] > is independent of 



k. Let N, 
-(fe) 



[dz.dj; 



2'=("M..^.i+o('= ")) be the number of 



b € % for which Z has dimension = dz and X has 
dimension = d^, where ry > 0. Evidently, 



A, 



[d^,d^ 



E 



A, 



[d'^,d'^ 



(26) 



d'^<d^,d'^<o 



The following inequality holds 



[nz,"x] 
[d^,d:,]/[0,0] 



^^[d^.d^]'^ 



2^ — k[d2m2+dxmx—a*^^ ^^^—0{k ^)] 



If we bound and m^, by the following inequalities 

dzfJiz + dxTiix > ^ ]+0(fc"^), for all [dz,dx] ^ [0,0], 

(27) 

where <(< rj, it follows that p2 for /c ^ 00. 
Neglecting the vanishing terms, it can be verified that 
the inequalities 

dzmz+dxTTix > Q;[d,,<ix]+0(A:"^/^), for all [dz,dx] ^ [0,0]. 

(28) 

are equivalent to (|27|l . Indeed, it follows from (|26|l that 
aK,d.] = + Oik-'/^) = af,, + 0(/c-i/4) for 

some d'z < dz and d'^ < dx- Since d'zmz + d^mx > 
= "[di.dil = "[d.,dx] (again neglecting vanishing 
terms) implies dziriz + dxrux > a solution to H28|) 

is also a solution to (|27|l and vice versa. From H28|) and 



it follows that p2 = 0(2~^) 



This leaves us to calculate A^i 



Let Gz e 



^njx(nj rfj) ^ ^^Y^ rank matrix with column space 
Gz- We define the space WziGz) = {VzGz \ Vz G Vz}. 
Then all elements of WziGz)^ = {Ab e Z^*= | I^jA6 = 
0, yWz e W2(52)} correspond to a with dimension 
<dz,as G^Az = WTAb = 0, VAz £ Z. We then have 



So far we have given an information-theoretical inter- 
pretation of the protocol: we start with an unknown 
pure state (represented by u), which, with probability 



Nid.,d.]^\ U w^(^-)^nw,(^,)^nTW I 

where Gz and Gx run through all subspaces of ' and 



> 1 — (5, is contained in 7^ . Consecutive measurements Z2 with dimension — dz and Ux — dx respectively. It 
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follows that 



r max \ Wz{Gz 



where 1 < r < the total number of combmations {Gz, Gx), 
which is independent of k. Therefore, r = 0(1). 

We now calculate \WziGz)^ n W^iGx)^ n t}'"^\. To 
this end, we first need to describe the spaces WziGz)^, 
y^x{Gx)^ and their intersection in a simpler way. In the 
following, et is a vector with a 1 on position t and zeros 
elsewhere and e is a vector with all ones. We investigate 
when Ab £ Wz{g)^, i.e. {Vzg)^Ab = 0, VV^ e Vz, where 
g G 7^2' ■ This can be written as 



g(g){A-^), 



A6 = 0, 



for all possibilities of {A and {Cf)i {I ~ riz + l, ■ 
It can be verified that 

Cl{eg®ei) = {6g®e)Qc. 

Therefore, H29|l is equivalent to 



(29) 
. ,n). 



g® a 
{9g (g) e) c 



A6 = 0, 



for all a G TZa and c G 7?.c. Let Me be a matrix whose 
column space is the orthogonal complement of that of Lg. 
Then all possible c are in the column space of Mg (g) ■ 
Since the distributions of a and c are independent, 129|) 
is equivalent to 



g 

ege^QMg 



>h) Ab = 0. 



(30) 



In an analogous way, we find that A6 G Wxig)'^ iff 

T 



( 



e'^ge'^QMeT 
9 



4) A6 = 0. 



(31) 



It is clear that Ab G Wz{Gz)^ Y^xiGx)^ iff Afe G 
Wz{{Gz)j)^, for J = 1 . ..nz-dz, and A6 G W,((G,)j)^, 
for j = 1 . . .Ux ^ dx- We can write this as 

(j'^(g)/fc)A6 = 0, 

where the column space oi J is the sum of the column 
spaces of the matrices in (|3U|I over all g = {Gz)j and in 
(|31|l over all 5 ~ {Gx)j- This gives rise to the definition 
of J given in section Hvl 

We have found that \Wz{Gz)^ n WxiGx)^ n r/''^| = 

|{6gT«|(J^0 4)A6 = O}|. 

Note that {J'^^Ik)Ab = is equivalent to (4® J^)A6' = 
0, or j'^A6i 



(j = 1, . . . , g) of the space = {w e Z^\J'^w = 0} 
constitute a partition of • We want to know the num- 

ber of G 7e for which bi is in the same coset as Ui, 
for all i = 1, . . . , /c. In section III BI we derived that this 
number is equal to 

2/c[-H-H_yi+0(e)]+0(log2 fe) 



where H 
Hjj 



E P{b)^og2p{b) 

E P(%)l0g2P(f^j) 



Choose (with dimension Uz — dz) and C/a; (with dimen- 
sion dx) such that Hj± is minimal. We denote this 
minimum by Then it follows that 

Let e = Then pi = (5 = 0{k-^t-^) = 0(/c-i/2). 

Recall that if (EHJ holds, p2 = 0(2"^). Therefore, the 
probability that the protocol fails, is 0(fc~^/^). Ne- 
glecting the vanishing terms, H28() can be formulated as 
the following linear programming problem: 

minimize m = -|- mx 
subject to dz-niz + dxTUx >H- H[a^,d^], 
for aU [dz.dx] ^ [0,0], 

and we have 7 = (1 — p_f)(1 — to) « 1 — to. Note that, as 
H > the constraints where dx — or = of 

the LP problem imply that m^, m^, > 0. 



VI. AN EXAMPLE 

In this section we illustrate the hashing protocol with 
an example. The 4-qubit cat state (also called GHZ 
state) is the state 



1 

which is stabilized by 

Oz 

h 
h 

<7x ' 

and thus represented by 



(|0000> + 11111)) 



5/2 

) (Jz 

> h ( 



i hf^cTz 

'i h®CFz 
)Uz® Oz 



' <Jx 



0, for i 



The cosets f2., 



"100" 




" 1 " 




" 0' 


1 




1 


and b — 





J Sx — 


1 




1 







111 




1 




_ 0_ 
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It is straightforward that nothing is gained by measur- 
ing according to a partition other than exclusively 
measurements or measurements. With (|14|l . we have 
6* = [1 1 1]. Note that Q is not orthogonal. We find 
= 1 and Lqt = [0 0]-^. The linear constraints 
become 

Si + ^2 + S3 + B4 = 
Ci = C2 = C3 = C4 = 

so a local Clifford operation that results in a permutation 
of all possible h is of the form 



'a 










A 










A 










A 






Bi 


+ B2 + B3 




A-^ 


A-^ 


A-^ 





and R is of the form 



BI 
BI 
Bl 



We formulate the linear programming problem to cal- 
culate the yield of the protocol. At the start, the 4 parties 
share k copies of a state 



P - 



^ Pfc|V'6)('06|, where 



IV'fa) = -^{\hiMM. 0) + {-if^\bi + 1, 62 + 1, 53 + 1, 1)). 

From Lg,LgT we find Mg — and Mgr = 13. We now 
calculate for different values of dz,dx- When 

dx = 0, we have Gx = I and V = I3. It follows that 
= {0} and therefore H^d^fi] — for all > 0. 
When dx = 1, we have Gx = and V ^ 0. From Mg ~ 0, 
it follows that U = 0. We now have 







Evidently, ^^[3,1] = -H"[ra^,n^] = 0- When dz = 0, we have 
Gz =13- It follows that 

-^[0,1] = " H ( H Pf')l0g2( 5] Pb)- 

f)i23ez| 64eZ2 64GZ2 

In both cases dz = 1 and dz = 2, we have to calculate 
Hj± for seven different subspaces J'-^. The minimum is 



or -ff[2,i] respectively. As an example, let dz 

and 



Gz = 



1 
1 1 
1 



The four cosets of are then (the first column is J^^): 



0000 


0010 


0100 


1000 


0001 


0011 


0101 


1001 


1110 


1100 


1010 


0110 


1111 


1101 


1011 


0111 



The LP problem is now 



minimize m — niz + mx 

subject to niz > 

mx> H - i/[o,i] 
rriz + mx > H - iJfi^j 
2mz + mx> H - Hy2.i] 
iniz + mx > H. 

For this example, we have compared our protocol to 
those of Refs. 0,13 ■ We start with copies of the 4-qubit 
cat state, prepared by the first party. The second, third 
and fourth qubit of each copy is sent through identical 
depolarizing channels to the corresponding parties. The 
action of each channel is 


Fp^ —{(TxPCrl + CTyPfrl + (Jzpol). 

and we call F the fidelity of the channels. It can be 
verified that this yields a mixture with probabilities: 



Poooo 
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2 


PllOl 
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2 
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2 


1 


.Pun . 
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1 


2 


1 _ 



F3 



F 



2 l-F 
3 , 



The yield of our protocol for this example is plotted as a 
function of the fidelity of the channels in figure |31 So is 
the yield of the protocol of Ref . 0] : 



1 



max [i/(6i)l 

i=i,2,3 
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FIG. 3: comparison of different protocols for the given cat 
state example. The dotted line gives the yield of the protocol 
of Ref. Q, the dashed line of that of Ref. Q and the solid 
line of our protocol, as a function of the fidelity F of the 
depolarizing channels. 



and the yield of the improved protocol of Ref. 



max (l — max — iJ(64|6i, 62, ^3), 

J— 1 ,2,3 



1- _uinx [Hib,\h)]~H{h: 

J = l,2,3 



Finally, we mention that for every cat state, it can be 
verified that there is no benefit in using more general lo- 
cal Clifford operations than CNOTs. We give another 
example where not only applying CNOTs pays off. Sup- 
pose we want to distill copies of the 8-qubit CSS state 
represented by 

"0111 
10 11 
110 1 
1110 

Note that, as 9 is orthogonal, R is given by (|21|l . The 
intial mixed states are diagonal in the S'-basis, with prob- 
abilities po = 3/4, j>i{,2 8=0, for all 62. ..s & ^2; 
Pob2...s = l/[4(2^ - 1)], for all 62.. .8 "^l- It can now 

be verified that the yield of our hashing protocol is equal 
to 



7 = 1-^ 
' 4 



0.36. 



Applying only CNOTs, the yield is equal to 
^ i?(&5...8) H-Hib5...s) 



1 



< 



H 

T 

H 



H 



3 

H{b5.. 



0.29 
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VII. CONCLUSION 

We have presented a hashing protocol to distill multi- 
partite CSS states, an important class of stabilizer states. 
Starting with k copies of a mixed state that is diagonal 
in the S'-basis, the protocol consists of local Clifford op- 
erations that result in a permutation of all 2"*^ tensor 
products of CSS states, followed by Pauli measurements 
that extract information on the global state. To find 
these local Clifford operations, we used the efficient bi- 
nary matrix description of stabilizer states and Clifford 
operations. With the aid of the information-theoretical 
notion of a strongly typical set, it is possible to calculate 
the minimal number of copies that have to be measured 
in order to end up with copies of a pure CSS state, for k 
approaching infinity. As a result, the yield of the proto- 
col is formulated as the solution of a linear programming 
problem. 



APPENDIX A: SOLVING EQS. llTHl)-(tT^ 

First, we show that follows from 1^1)- Com- 
paring each corresponding block on both sides of Hlt)|) 
yields: 



+u 



ifOuv — 1, for u ~ 1, 



and V ~ 1, 



■ 



From this, it is clear that all Ai {i = 1, . . . ,n) must be 
equal. If not, it is possible to divide {1, . . . , n} into two 
disjunct nonempty subsets loi and uj2 for which 9uv = if 
Uz + u LOi and u € a;2 or vice versa. We could permute 
rows and columns of 9 such that the resulting 9' — Tr9Tc 
has all rows ui for which Uz +ui € wi above rows U2 for 
which Uz +U2 a UJ2, and all columns vi for which vi € coi 
on the left of columns V2 for which V2 G i-U2. We then 
have 



/ 



"tJ ■ 




I 




I 




/ 


Tr 




9 


9' 




* 







It is clear that this represents a separable CSS state, 
which we excluded from the beginning. An analogous 
proof holds for the Di. 

Second, we show that if 9 is not orthogonal, with H18|) - 
ifT^ we can find subsets Zb and Zc of {l,...,n} for 
which all Bi and Ci are zero if z G Zb or Zc respectively. 
Note that (|18|) is equivalent to 

(Sj®4)^(S,0/fe) = 0. 

We can rewrite this as linear constraints on the Bi as 
follows 



Bi 



Bn 



(Al) 
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The n-bit columns of are {Sx)j {Sx)u Vj, ? : 1 < j < 
I < rix- Note that HA1|I is the same as (|23|l . We can do the 
same for (|19|l . We denote the column spaces of and 
Lz by £x and Cz respectively. As the constraints ((TH|) - 
(|19|l are independent, all solutions _B must be consistent 
with all solutions C. From ifT^ - lfTi^ . it follows that 

{9®h)BzCz - {9®h)Bz{9^ ®h)C^{9®h) 
= B..C^{9®h). 

In the same way as for H20II . we can prove then that 
BiCi = ... ^ BnCn. If B,C^ = 0, then either 
or Ci = 0. Indeed, suppose Bi ^ Q. Then ^ Cx. 
Consequently, there exist some solution p to L'^p — 
with {p)i = 1. Note that p® Ik is a solution to HA1|I . It 
follows that Bid = IkCi = 0. 

This leaves us to prove that BiCi ^ only if 6 is 
orthogonal. Suppose BiC'i ^ 0, for all i = 1, . . . , rt, then, 
for every i, there exists a solution p to L^p ~ with 
{p)i — \. It is clear that, for every i and j, there also 
exists a solution p with (p)i = (p)j = 1. So, for every i 
and j, we have a solution i? to ljAl|l with Bi = Bj = Ik 
that must be consistent with all solutions C. It follows 
that Ci = . . . = Cn- The same holds for the Bi. This 
implies that the spaces Cx and Cz are equal and consist 
of all vectors of even weight. No vector of odd weight 
is in Cz, otherwise Cz would be the entire space Z2 and 
consequently d = 0. So all {Sx)j&{Sx)i and {Sz)j&{Sz)i 
must have even weight. With 1141) . it can be verified 
that this only holds if {9)l{9)y = {9'^)l{9^)v = 
where 6uv is the Kronecker delta. This is equivalent with 
9^9 - 99^ = I. 



APPENDIX B: PROOF OF CONSTANT 
ELIMINATION PROBABILITY 

We show that the probability that a state, initially 
represented by b for which Z has dimension dz and X 
has dimension dx, is not eliminated after the protocol 
has ended, is equal to 2-'=('*-'"-+''-™-)+0(2-^'=)^ pirst, we 
show that this probabihty > 2-*=(''-"=+''-"-). Without 
loss of generality, we assume that the i-th copy is mea- 
sured in the i-th step. We consider all measurements 
performed at the end (cfr. the two equivalent views of 
the protocol depicted in figure and we call the overall 
transformation matrix R. Then the i-th measurement 
in fact reveals {R'^u)i^j^i)k+i, for j = l,...,nz, if it is 
a az measurement or for j — + 1, . . . , n if it is a Cx 
measurement. Following the reasoning of section [3 it is 
clear that for each measurement, no other outcome Az 
or Ax than those in 2^ or in A" can occur. 

However, it is possible that during the process (after 
some measurements) , one or both of the sets of outcomes 
Z and X (corresponding to the transformed R^b) are 
strictly smaller than Z and X, which means that the 
probability of not being eliminated by a measurement is 
larger than at the start. Suppose the first measurement 



is a az measurement on the fc-th copy. Recall that a 
measurement inevitably involves the loss of the phase fac- 
tors of observables noncommuting with the measurement. 
This loss of information causes initially different b S Zj'"' 
to be mapped to the same vector in . Indeed, b is 

mapped to R'^b, where R is equal to R without columns 
jk, for j = 1, . . . ,n. We investigate when Wv = RFw 
and v^w correspond concerning the measurement out- 
come (otherwise at most one is not eliminated). This is 
the case iff (i?-^)i(w-)-w) = 0, for all I except {nz-\-j)k, for 
j ~ 1, . . . , Tlx. Equivalently, v + w £ Q, where Q is the 
?ix-dimcnsional space generated by columns (rt^ + j)fc, 
for j — 1, . . . ,nx, of R~^ . If we assume that 9 is not 
orthogonal (the orthogonal case is analogous), then from 
((T^ and (1221), we have 

^-T ^ [ In^® {9^ Ik)C^ ' 
[(0 0/fe)Bj In^®A-^ 

Let be defined as in section Hvl where Qz and Qx 
have dimensions — d'^ and rix — d'^ respectively and 
d'^ < dz or d'^ < dx- Consequently, Ab ^ ® 7L\. 
We investigate when T{Fb S ® ^2"^- For every Av g 
Tl]^^ that satisfies Avi e , for i = 1, . . . , fc— 1, there 
is a Aw £ TH^ that satisfies Awi £ , for i = 1, . . . , fc, 
and R Aw — Av. Indeed, define some At £ Z^'' such 
that Ati = Avi, for z = 1, . . . , fc - 1, and Atk £ J^. 
Let Aw = R^'^At. From the definition of R, it follows 
that R^ Aw ~ Av. In the previous paragraph, we have 
shown that the set of all At that satisfy Ati £ is 
invariant under left multiplication by some i?-^, where R 
is given by (|22|l . As R is invertible, the same holds for 
R^^ . Therefore, Awi £ J^, for i = 1, . . . , fc. It follows 
that R^b £ (g) Z2 ^^ iff there is some q £ Q and some 
Aw £ J-^ i» Z^ such that Ab + q = Aw. 

Let q{v) = J2jiv)jiR'^)in.+j)k G Q, where e Z^==. 
In the same way as in section Hvl it can be verified that 
qi(v), for i = l,...,fc, all satisfy the same linear con- 
straints. Let Cv be the space of vectors that satisfy these 
constraints. All qi{v), for i = 1, . . . , fc, are uniformly and 
independently distributed over If Cy C J^, then 
there is no q{v) such that Abi + qi{v) £ J^, as Abi ^ 
for some i. Therefore, £„ must (/i . Let ^ > 2 be the 
number of cosets n within £„. All cosets have 
the same number of elements. Therefore, the probability 
that Abi + qi{v) £ is at most < 2"^ Note that 
if {Abi + J^) n Cy — 0, this probability is zero. Because 
qi{v), for i — 1, . . . ,fc, are independent, the probability 
that Abi + qi{v) £ J^, for alH ~ 1, . . . , fc, is at most 
2^*^. The probability that there is some q £ Q such 
that Abi + qi £ , for all z = 1, . . . , fc, is then at most 
2-'=+"-. The probability that \Z\ < \Z\ or \X\ < \X\ 
after the last measurement of the protocol, is therefore 
at most 

mk 

< rmfc2-T'^+" = 
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where r, independent of fc, is the total number of com- 
binations {GzjGx) with proper dimensions. Note that 
^ = 0(2"''''^). The probability that b is not eliminated 
by a az (or (Jx) measurement is at most 2~'^'' + ^ (or 
^ Consequently, the probability that b survives 
the entire process is at most 
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